由 chinadoudou 在 11-05-2002 11:29 发表:
转一个国产的防火墙脚本
DMZ部分尚不完善，其中难免有疏漏，希望大家跟我一块改进，使他功能越来越强大，使用时请将firewall-dev copy 到/etc/rc.d/init.d将 firewall.conf copy /etc/下，你只需修改firewall.conf文件就可以了。可以用firewall-dev start|stop起动和关闭防火墙，功能增加中，如你有任何改动请发一份给我，[email protected]
本着GPL的原则希望有志之士跟我一块完善它，如有改动请通知我！！！！
firewall-dev
>
> 源码:
>
> * * *
>
>
> >
> #!/bin/bash
> >
> # This is a firewall script with the function of stateful and
> >
> # ip filter, you can change it to meet you need,in a words:
> >
> # uplink means the output interface ,router means if you neet it
> >
> # to be a router or not,nat means if you are useing a dynamic ip
> >
> # address
> >
> # if you do ,then you can change it to "dynamic",interfaces means
> >
> # all the interface in you server ,services means all the services
> >
> # you server providing ,enjoy it !!! ----- write by arlenecc
> >
> #
> >
> ##############################################################################
> >
> # #
> >
> # Copyright (c) 2002 arlenecc [email protected] #
> >
> # All rights reserved #
> >
> # #
> >
> ##############################################################################
> >
> #
> >
> # now begins the firewall
> >
>
> >
>
> >
> UPLINK=less /root/firewall.conf | grep "UPLINK" | cut -d = -f 2
> >
>
> >
> UPIP=less /root/firewall.conf | grep "UPIP" | cut -d = -f 2
> >
>
> >
> ROUTER=less /root/firewall.conf | grep "ROUTER" | cut -d = -f 2
> >
>
> >
> NAT=less /root/firewall.conf | grep "NAT" | cut -d = -f 2
> >
>
> >
> INTERFACES=less /root/firewall.conf | grep "INTERFACES" | cut -d = -f 2
> >
>
> >
> SERVICES=less /root/firewall.conf | grep "SERVICES" | cut -d = -f 2
> >
>
> >
> DENYPORTS=less /root/firewall.conf | grep "DENYPORTS" | cut -d = -f 2
> >
>
> >
> DENYUDPPORT=less /root/firewall.conf | grep "DENYUDPPORT" | cut -d = -f 2
> >
>
> >
> LAN_IF=less /root/firewall.conf | grep "LAN_IF" | cut -d = -f 2
> >
>
> >
> LAN_NET=less /root/firewall.conf | grep "LAN_NET" | cut -d = -f 2
> >
>
> >
> DMZ_NET=less /root/firewall.conf | grep "DMZ_NET" | cut -d = -f 2
> >
>
> >
> DMZ_IF=less /root/firewall.conf | grep "DMZ_IF" | cut -d = -f 2
> >
>
> >
> DMZ_TCP_PORT=less /root/firewall.conf | grep "DMZ_TCP_PORT" | cut -d = -f 2
> >
>
> >
> DMZ_UDP_PORT=less /root/firewall.conf | grep "DMZ_UDP_PORT" | cut -d = -f 2
> >
>
> >
> WEB_IP=less /root/firewall.conf | grep "WEB_IP" | cut -d = -f 2
> >
>
> >
> FTP_IP=less /root/firewall.conf | grep "FTP_IP" | cut -d = -f 2
> >
>
> >
> H323_PORT=less /root/firewall.conf | grep "H323_PORT" | cut -d = -f 2
> >
>
> >
> H323=less /root/firewall.conf | grep "H323" | cut -d = -f 2
> >
>
> >
>
> >
>
> >
>
> >
>
> >
> if [ "$1" = "start" ]
> >
> then
> >
> echo "Starting firewall......"
> >
>
> >
> echo "NOW prepareing kernel for use,please wait....."
> >
>
> >
> # if [ -e /proc/sys/net/ipv4/ip_forward ]
> >
> #
> >
> # then
> >
> # echo 1 >/proc/sys/net/ipv4/ip_forward
> >
> # fi
> >
> if [ "$NAT" = " dynamic " ]
> >
> then
> >
> echo "Enable dynamic ip support...."
> >
> echo 1 > /proc/sys/net/ipv4/ip_dynaddr
> >
> echo " OK !!!!"
> >
> fi
> >
> if [ -e /proc/sys/net/ipv4/tcp_syncookies ]
> >
> then
> >
> echo "Enable the syn cook flood protection"
> >
> echo 1 > /proc/sys/net/ipv4/tcp_syncookies
> >
> echo " OK !!!!"
> >
> fi
> >
> if [ -e /proc/sys/net/ipv4/ip_conntrack_max ]
> >
> then
> >
> echo "Setting the maximum number of connections to track.... "
> >
> echo "4096" > /proc/sys/net/ipv4/ip_conntrack_max
> >
> echo " OK !!!!"
> >
> fi
> >
>
> >
> if [ -e /proc/sys/net/ipv4/ip_local_port_range ]
> >
> then
> >
> echo " Setting local port range for TCP/UDP connection...."
> >
> echo -e "32768\t61000" > /proc/sys/net/ipv4/ip_local_port_range
> >
> echo " OK !!!!"
> >
> fi
> >
>
> >
> if [ -e /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses ]
> >
> then
> >
> echo "Enable bad error message protection......."
> >
> echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
> >
> echo " OK !!!! "
> >
> fi
> >
> if [ -e /proc/sys/net/ipv4/tcp_ecn ]
> >
> then
> >
> echo "Disabling tcp_ecn,please wait..."
> >
> echo 0 >/proc/sys/net/ipv4/tcp_ecn
> >
> echo " OK !!!! "
> >
> fi
> >
>
> >
> for x in ${INTERFACES}
> >
> do
> >
> echo " Enabling rp_filter on ${x} ,please wait...."
> >
> echo 1 > /proc/sys/net/ipv4/conf/${x}/rp_filter
> >
> echo " ${x} OK !!!! "
> >
> done
> >
>
> >
> if [ -e /proc/sys/net/ipv4/conf/all/accept_redirects ]
> >
>
> >
> then
> >
>
> >
> echo "Disabing ICMP redirects,please wait...."
> >
> echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
> >
> echo " OK !!!! "
> >
> fi
> >
>
> >
> if [ -e /proc/sys/net/ipv4/conf/all/accept_source_route ]
> >
>
> >
> then
> >
> echo "Disabling source routing of packets,please wait...."
> >
> for i in /proc/sys/net/ipv4/conf/*/accept_source_route
> >
>
> >
> do
> >
> echo 0 > $i
> >
> echo " $i OK !!!! "
> >
>
> >
> done
> >
>
> >
> fi
> >
> if [ -e /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts ]
> >
> then
> >
> echo "Ignore any broadcast icmp echo requests......"
> >
> echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
> >
> echo " OK !!!! "
> >
> fi
> >
>
> >
> # if [ -e /proc/sys/net/ipv4/config/all/log_martians ]
> >
> #
> >
> # then
> >
> # echo "LOG packets with impossible addresses to kernel log...."
> >
> # echo 1 > /proc/sys/net/ipv4/conf/all/log_martians
> >
> # echo " OK !!!! "
> >
> # fi
> >
> #echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_all
> >
> #modprobe ip_tables
> >
> depmod -a
> >
>
> >
>
> >
> iptables -P INPUT DROP
> >
> iptables -P FORWARD DROP
> >
> iptables -P OUTPUT DROP
> >
> iptables -F INPUT
> >
> iptables -F FORWARD
> >
> iptables -F OUTPUT
> >
> iptables -F -t nat
> >
> iptables -F -t mangle
> >
> iptables -Z
> >
> iptables -X
> >
> iptables -N CHECK_FLAGS
> >
> iptables -F CHECK_FLAGS
> >
> iptables -N tcpHandler
> >
> iptables -F tcpHandler
> >
> iptables -N udpHandler
> >
> iptables -F udpHandler
> >
> iptables -N icmpHandler
> >
> iptables -F icmpHandler
> >
> iptables -N DROP-AND-LOG
> >
> iptables -F DROP-AND-LOG
> >
>
> >
>
> >
> echo "OK,the kernel is now prepared to use for building a firewall!!!"
> >
> echo "Waitting ........................"
> >
> echo "Creating a drop chain....."
> >
> iptables -A DROP-AND-LOG -j LOG --log-level 5
> >
> iptables -A DROP-AND-LOG -j DROP
> >
> echo " OK !!!!"
> >
> echo "Now starting the check_flag rules,please wait...."
> >
>
> >
> iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL FIN,URG,PSH -m limit --limit 5/minute -j LOG --log-level 6 --log-prefix " INVAILD NMAP SCAN "
> >
> iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
> >
> iptables -A CHECK_FLAGS -p tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 5/minute -j LOG --log-level 6 --log-prefix " SYN/RST "
> >
> iptables -A CHECK_FLAGS -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
> >
> iptables -A CHECK_FLAGS -p tcp --tcp-flags SYN,FIN SYN,FIN -m limit --limit 5/minute -j LOG --log-level 6 --log-prefix " SYN/FIN SCAN "
> >
> iptables -A CHECK_FLAGS -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
> >
> iptables -A CHECK_FLAGS -p tcp --tcp-option 64 -m limit --limit 5/minute -j LOG --log-level 6 --log-prefix " Bogus TCP FLAG 64 "
> >
> iptables -A CHECK_FLAGS -p tcp --tcp-option 64 -j DROP
> >
> iptables -A CHECK_FLAGS -p tcp --tcp-option 128 -m limit --limit 5/minute -j LOG --log-level 6 --log-prefix " Bogus TCP FLAG 128 "
> >
> iptables -A CHECK_FLAGS -p tcp --tcp-option 128 -j DROP
> >
> iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL ALL -m limit --limit 5/minute -j LOG --log-level 6 --log-prefix "Merry Xmas Tree:"
> >
> iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL ALL -j DROP
> >
> iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -m limit --limit 5/minute -j LOG --log-level 6 --log-prefix "XMAS-PSH:"
> >
> iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
> >
> iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL NONE -m limit --limit 5/minute -j LOG --log-level 6 --log-prefix "NULL_SCAN"
> >
> iptables -A CHECK_FLAGS -p tcp --tcp-flags ALL NONE -j DROP
> >
>
> >
> echo " OK !!!! Finished check_flags rules...."
> >
>
> >
>
> >
> echo "Now starting the input rules,please wait......."
> >
> for x in ${DENYPORTS}
> >
>
> >
>
> >
> do
> >
> iptables -A INPUT -i ${UPLINK} -p tcp --dport ${x} -m state --state NEW -j LOG --log-prefix "INVAILD PORT:${x} TCP IN:"
> >
> iptables -A INPUT -i ${UPLINK} -p tcp --dport ${x} -m state --state NEW -j DROP
> >
> iptables -A INPUT -i ${UPLINK} -p tcp --syn --dport ${x} -j LOG --log-prefix "INVAILD PORT:${x} SYN IN:"
> >
> iptables -A INPUT -i ${UPLINK} -p tcp --syn --dport ${x} -j DROP
> >
> done
> >
>
> >
> for x in ${DENYUDPPORT}
> >
>
> >
> do
> >
> iptables -A INPUT -i ${UPLINK} -p udp --dport ${x} -m state --state NEW -j LOG --log-prefix "INVAILD PORT:${x} UDP IN:"
> >
> iptables -A INPUT -i ${UPLINK} -p udp --dport ${x} -m state --state NEW -j DROP
> >
> iptables -A INPUT -i ${UPLINK} -p udp --dport ${x} -j LOG --log-prefix "INVALID PORT:${x} UDP IN:"
> >
> iptables -A INPUT -i ${UPLINK} -p udp --dport ${x} -j DROP
> >
> done
> >
>
> >
>
> >
> #iptables -A INPUT -i ! ${UPLINK} -j ACCEPT
> >
>
> >
>
> >
> for x in ${SERVICES}
> >
>
> >
> do
> >
> iptables -A INPUT -i ${UPLINK} -p tcp --dport ${x} -m state --state ESTABLISHED,RELATED -j ACCEPT
> >
> iptables -A INPUT -i ${UPLINK} -p tcp --dport ${x} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
> >
> done
> >
>
> >
> iptables -A INPUT -i ${UPLINK} -s 192.168.0.0/24 -j DROP-AND-LOG
> >
> iptables -A INPUT -i ${UPLINK} -s 10.0.0.0/8 -j DROP-AND-LOG
> >
> iptables -A INPUT -i ${UPLINK} -s 172.12.0.0/16 -j DROP-AND-LOG
> >
> iptables -A INPUT -i ${UPLINK} -s 224.0.0.0/4 -j DROP-AND-LOG
> >
> iptables -A INPUT -i ${UPLINK} -s 240.0.0.0/5 -j DROP-AND-LOG
> >
>
> >
>
> >
> #iptables -A INPUT -i ${LAN} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
> >
> iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> >
> #iptables -A INPUT -i ${UPLINK} -j LOG --log-prefix " INVALID INPUT "
> >
> iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
> >
> iptables -A INPUT -i ${LAN_IF} -p tcp --syn -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
> >
> iptables -A INPUT -i ${DMZ_IF} -p tcp --syn -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
> >
> iptables -A INPUT -p tcp --tcp-flags ALL SYN,ACK -j REJECT
> >
> iptables -A INPUT -p tcp -i ${LAN_IF} -d ${LAN_NET} -s ${DMZ_NET} -j LOG --log-prefix "INVAILD TCP FROM DMZ:"
> >
> iptables -A INPUT -p tcp -i ${LAN_IF} -d ${LAN_NET} -s ${DMZ_NET} -j REJECT --reject-with tcp-reset
> >
> iptables -A INPUT -p udp -i ${LAN_IF} -d ${LAN_NET} -s ${DMZ_NET} -j LOG --log-prefix "INVAILD UDP FROM DMZ:"
> >
> iptables -A INPUT -p udp -i ${LAN_IF} -d ${LAN_NET} -s ${DMZ_NET} -j DROP
> >
> iptables -A INPUT -p icmp -i ${LAN_IF} -d ${LAN_NET} -s ${DMZ_NET} -j LOG --log-prefix "INVAILD ICMP FROM DMZ:"
> >
> iptables -A INPUT -p icmp -i ${LAN_IF} -d ${LAN_NET} -s ${DMZ_NET} -j DROP
> >
> iptables -A INPUT -p tcp -i ${UPLINK} --syn -j LOG --log-prefix "INVALID SYN REQUIRE:"
> >
> iptables -A INPUT -p tcp -i ${UPLINK} --syn -j DROP
> >
> iptables -A INPUT -p icmp -i ${UPLINK} -j LOG --log-prefix "INVAILD ICMP IN:"
> >
> iptables -A INPUT -p icmp -i ${UPLINK} -j REJECT --reject-with icmp-net-unreachable
> >
> iptables -A INPUT -p udp -i ${UPLINK} -j LOG --log-prefix "INVAILD UDP IN:"
> >
> iptables -A INPUT -i ${UPLINK} -p udp -j REJECT --reject-with icmp-port-unreachable
> >
> iptables -A INPUT -i ${UPLINK} -p tcp -j LOG --log-prefix "INVAILD TCP IN:"
> >
> iptables -A INPUT -i ${UPLINK} -p tcp -j REJECT --reject-with tcp-reset
> >
> iptables -A INPUT -i ${UPLINK} -m state --state NEW,INVALID -j LOG --log-prefix "NEW,INVALID state:"
> >
> iptables -A INPUT -i ${UPLINK} -m state --state NEW,INVALID -j DROP
> >
> iptables -A INPUT -i ${UPLINK} -f -j LOG --log-prefix "INVAILD FRAGMENTS ${UPLINK}:"
> >
> iptables -A INPUT -i ${UPLINK} -f -j DROP
> >
> iptables -A INPUT -i ${LAN_IF} -f -j LOG --log-prefix "INVAILD FRAGMENT ${LAN_IF}:"
> >
> iptables -A INPUT -i ${LAN_IF} -f -j DROP
> >
> iptables -A INPUT -i ${DMZ_IF} -f -j LOG --log-prefix "INVAILD FRAGMENT ${DMZ_IF}:"
> >
> iptables -A INPUT -i ${DMZ_IF} -f -j DROP
> >
> iptables -A INPUT -i ${UPLINK} -j DROP
> >
> echo " OK !!!! The input rules has been successful applied ,continure......"
> >
>
> >
> echo " Now starting FORWARD rules ,please wait ....."
> >
>
> >
> iptables -A FORWARD -f -m limit --limit 1/s --limit-burst 10 -j ACCEPT
> >
> iptables -A FORWARD -p icmp -m limit --limit 1/s --limit-burst 10 -j ACCEPT
> >
> iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
> >
> iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j DROP
> >
> iptables -A FORWARD -p tcp --tcp-flags ALL ALL -j DROP
> >
> iptables -A FORWARD -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
> >
> iptables -A FORWARD -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
> >
> iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
> >
> iptables -A FORWARD -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
> >
> iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
> >
> iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
> >
> iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> >
> iptables -A FORWARD -i ${LAN_IF} -o ${UPLINK} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
> >
> iptables -A FORWARD -i ${DMZ_IF} -o ${UPLINK} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
> >
> iptables -A FORWARD -i ${UPLINK} -p tcp -m state --state NEW -m limit --limit 5/minute --limit-burst 10 -j LOG --log-prefix " CONN TCP: "
> >
> iptables -A FORWARD -i ${UPLINK} -p tcp -m state --state NEW -j tcpHandler
> >
> iptables -A FORWARD -i ${UPLINK} -p udp -m state --state NEW -m limit --limit 5/minute --limit-burst 10 -j LOG --log-prefix " CONN UDP:"
> >
> iptables -A FORWARD -i ${UPLINK} -p udp -m state --state NEW -j udpHandler
> >
> iptables -A FORWARD -i ${UPLINK} -p icmp -m state --state NEW -m limit --limit 5/minute --limit-burst 10 -j LOG --log-prefix " CONN ICMP: "
> >
> iptables -A FORWARD -i ${UPLINK} -p icmp -m state --state NEW -j icmpHandler
> >
> iptables -A tcpHandler -p tcp -m limit --limit 5/minute --limit-burst 10 -j RETURN
> >
> iptables -A tcpHandler -p tcp -j LOG --log-prefix " Drop TCP exceed connections "
> >
> iptables -A tcpHandler -p tcp -j DROP
> >
> iptables -A udpHandler -p udp -m limit --limit 5/minute --limit-burst 10 -j RETURN
> >
> iptables -A udpHandler -p udp -j LOG --log-prefix "Drop UDP exceed connections"
> >
> iptables -A udpHandler -p udp -j DROP
> >
> iptables -A icmpHandler -p icmp -m limit --limit 5/minute --limit-burst 10 -j RETURN
> >
> iptables -A icmpHandler -p icmp -j LOG --log-prefix "Drop ICMP exceed connections"
> >
> iptables -A icmpHandler -p icmp -j DROP
> >
>
> >
> iptables -A FORWARD -i ${UPLINK} -o ${LAN_IF} -m state --state ESTABLISHED,RELATED -j ACCEPT
> >
> iptables -A FORWARD -i ${UPLINK} -o ${DMZ_IF} -m state --state ESTABLISHED,RELATED -j ACCEPT
> >
> iptables -A FORWARD -i ${LAN_IF} -o ${UPLINK} -j ACCEPT
> >
> iptables -A FORWARD -i ${DMZ_IF} -o ${UPLINK} -j ACCEPT
> >
> #iptables -A FORWARD -o ${UPLINK} -i ${LAN} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
> >
> #iptables -A FORWARD -o ${UPLINK} -i ${DMZ} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
> >
> iptables -A FORWARD -o ${LAN_IF} -i ${DMZ_IF} -p tcp -j LOG --log-prefix "INVAILD TCP FORWARD FROM DMZ:"
> >
> iptables -A FORWARD -o ${LAN_IF} -i ${DMZ_IF} -p tcp -j REJECT --reject-with tcp-reset
> >
> iptables -A FORWARD -o ${LAN_IF} -i ${DMZ_IF} -p udp -j LOG --log-prefix "INVAILD UDP FORWARD FROM DMZ:"
> >
> iptables -A FORWARD -o ${LAN_IF} -i ${DMZ_IF} -p udp -j DROP
> >
> iptables -A FORWARD -o ${LAN_IF} -i ${DMZ_IF} -p icmp -j LOG --log-prefix "INVAILD ICMP FORWARD FROMDMZ:"
> >
> iptables -A FORWARD -o ${LAN_IF} -i ${DMZ_IF} -p icmp -j DROP
> >
> iptables -A FORWARD -p icmp -s ${LAN_NET} -d ${DMZ_NET} -m limit --limit 1/s --limit-burst 10 -j ACCEPT
> >
> iptables -A FORWARD -s ${LAN_NET} -d ${DMZ_NET} -i ${LAN_IF} -j ACCEPT
> >
> iptables -A FORWARD -p tcp -d ${LAN_NET} -s ${DMZ_NET} -i ${DMZ_IF} ! --syn -j ACCEPT
> >
> iptables -A FORWARD -p icmp --icmp-type 0 -s ${DMZ_NET} -d ${LAN_NET} -m limit --limit 1/s --limit-burst 10 -j ACCEPT
> >
>
> >
>
> >
> iptables -A FORWARD -p tcp -s ${DMZ_NET} -d ${LAN_NET} -j LOG --log-prefix "INVAILD TCP FORWARD DATA"
> >
> iptables -A FORWARD -p tcp -s ${DMZ_NET} -d ${LAN_NET} -j DROP
> >
> iptables -A FORWARD -p udp -s ${DMZ_NET} -d ${LAN_NET} -j LOG --log-prefix "INVAILD UDP FORWARD DATA"
> >
> iptables -A FORWARD -p udp -s ${DMZ_NET} -d ${LAN_NET} -j DROP
> >
> iptables -A FORWARD -p icmp -s ${DMZ_NET} -d ${LAN_NET} -j LOG --log-prefix "INVALID ICMP FORWARD DATA"
> >
> iptables -A FORWARD -p icmp -s ${DMZ_NET} -d ${LAN_NET} -j DROP
> >
> iptables -A FORWARD -m state --state NEW,INVALID -j DROP
> >
> iptables -A FORWARD -j DROP
> >
>
> >
> echo " OK !!!! The forward rules has been successful applied,conniture......"
> >
> echo " Now applying output rules,please wait ...."
> >
> iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> >
> iptables -A OUTPUT -s ${LAN_NET} -o ${UPLINK} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
> >
> iptables -A OUTPUT -s ${DMZ_NET} -o ${UPLINK} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
> >
> iptables -A OUTPUT -s ${LAN_NET} -o ${DMZ_IF} -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
> >
> iptables -A OUTPUT -s ${DMZ_NET} -o ${LAN_IF} -p tcp -j LOG --log-prefix "INVAILD TCP OUTPUT FROM DMZ:"
> >
> iptables -A OUTPUT -s ${DMZ_NET} -o ${LAN_IF} -p tcp -j REJECT --reject-with tcp-reset
> >
> iptables -A OUTPUT -s ${DMZ_NET} -o ${LAN_IF} -p udp -j LOG --log-prefix "INVAILD UDP OUTPUT FROM DMZ:"
> >
> iptables -A OUTPUT -s ${DMZ_NET} -o ${LAN_IF} -p udp -j DROP
> >
> iptables -A OUTPUT -s ${DMZ_NET} -o ${LAN_IF} -p icmp -j LOG --log-prefix "INVAILD ICMP OUTPUT FROM DMZ:"
> >
> iptables -A OUTPUT -s ${DMZ_NET} -o ${LAN_IF} -p icmp -j DROP
> >
> iptables -A OUTPUT -o lo -j ACCEPT
> >
> iptables -A OUTPUT -p icmp -m state --state INVALID -j LOG --log-prefix "INVAILD ICMP STATE OUTPUT:"
> >
> iptables -A OUTPUT -p icmp -m state --state INVALID -j DROP
> >
> iptables -A OUTPUT -m state --state NEW,INVALID -j LOG --log-prefix "INVAILD NEW,INVALID STATE:"
> >
> iptables -A OUTPUT -m state --state NEW,INVALID -j DROP
> >
>
> >
> iptables -A OUTPUT -j DROP
> >
>
> >
> echo " OK !!!! The OUTPUT rules has been successful applied,conniture......."
> >
>
> >
> echo " Now applying nat rules ,please wait ...."
> >
> #iptables -t nat -A POSTROUTING -o eth1 -s 192.168.1.0/24 -j MASQUERADE
> >
> #iptables -t nat -A PREROUTING -p tcp -i eth1 --dport 23 -j REDIRECT --to-port 14867
> >
> iptables -t nat -A PREROUTING -d ${LAN_NET} -i ${UPLINK} -j DROP
> >
> iptables -t nat -A PREROUTING -d ${DMZ_NET} -i ${UPLINK} -j DROP
> >
>
> >
>
> >
>
> >
> if [ " $ROUTER " = " yes " ]
> >
>
> >
> then
> >
> echo " enabing ip_forward,please wait..."
> >
> echo 1 >/proc/sys/net/ipv4/ip_forward
> >
> echo "OK"
> >
> if [ " $NAT " = " dynamic " ]
> >
>
> >
> then
> >
> echo "Enableing MASQUERADING (dynamic ip )..."
> >
> echo "Dynamic PPP connection,Now getting the dynamic ip address"
> >
> IP_ADDR=ifconfig ppp0 | grep inet | cut -d : -f 2 | cut -d " " -f 1
> >
> echo " N